"Rasberry PI's are extremely problematic devices from a security perspective. They use a coarse-grained clock, so it's very hard toget good entropy out of timing events, and very the hardware that they have on them is such that there aren't many events that we can use to generate entropy in the first place." - Theodore Y. Ts'o

There is a bcm2708-rng.ko kernel module you can load and if you use rng-tools or rng-tools5 package*, that'll greatly improve the entropy pool.I don't know if that would be good entropy (or whether there is such a thing as good/bad entropy) as that is outside my area of expertise.

@hardingWhat I gathered from Ts'o's remarks is that basically every user has to decide for themselves which devices to trust and "X.rng_quality=Y" kernel parameter seems to indicate you also need to know how good a HWRNG is.Theodore's reasoning is quite logical, but I'm guessing unfeasible for 99% of 'normal' people.I happen to know of it, but I can't say that I (really) understand it.

In general terms yes, but not details and they seem to matter quite a bit.

@FreePietje@harding The random-seed file's purpose is to retain entropy between boots. Any reading of the file after booting is foolish (though writing to it before shutdown can make the system more robust against power loss, which I'm surprised by that is not considered relevant enough to implement).

@kekcoin@hardingDo read (all) the posts regarding this on debian-devel (spread over multiple months). I'm quite sure they discussed this.After reading that I realized that randomness was far more complex then I ever realized. That's also why I prefer to refer to that thread then try to summaries the things that I still remember.

@FreePietje@harding Will do, thanks. It's a bit out of scope for my current project due to time constraints, but I am interested in distilling the wisdom from these kinds of discussions into a "hardening raspi setup" guide.